---
typeId: req
recordId: benac-auth-002
fields:
  title: Authentication is not authority
  statement: Authentication shall not by itself grant package execution authority,
    capability grants, secret access, storage authority, compute authority,
    replication authority, plaintext disclosure authority, or trust.
  rationale: A Station can authenticate a dangerous or untrusted actor perfectly.
    Benac must still govern power locally.
  verification: Authenticate a remote Station, package author, and agent that lack
    local grants and verify that each remains unable to perform
    authority-bearing operations.
  testable: true
  status: draft
  area: BENAC-AUTH
  sourceDocument: /home/johnb/Downloads/benac_syrs_v0_4_integrated_authentication.md
  sourceVersion: v0.4
  sourceSections:
    - 10.2 Authentication and authority boundaries
  order: 17
---
